ateomnet: move the actor nftables table to the inet family - #1116
Open
Yuan Gao (ygao-g) wants to merge 1 commit into
Open
ateomnet: move the actor nftables table to the inet family#1116Yuan Gao (ygao-g) wants to merge 1 commit into
Yuan Gao (ygao-g) wants to merge 1 commit into
Conversation
This was referenced Aug 21, 2026
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
August 21, 2026 04:40
aab125d to
d7aab40
Compare
Benjamin Elder (BenTheElder)
added a commit
to BenTheElder/substrate
that referenced
this pull request
Aug 21, 2026
Both ateoms now build actor networking through internal/actornet, so ateomnet's version has had no caller outside its own package since the micro-VM ateom moved. This deletes it: SetupActorNetwork, NetworkConfig, CleanupActorNetwork, ConfigureActorVeth, the nftables install and remove, their expression helpers, and PodIPv4 and DumpNetInfo, which only those used. What stays is what actornet actually consumes -- the veth constants and addresses, MustParse*, EnableIPv4Forwarding, TCPProtocol, and the namespace helpers. Leaving it would not have been merely untidy. It creates a table named ateom_actor in the ip family, and actornet creates one under the same name for the actors that are really running; a table name is unique per family, so the two are invisible to each other's cleanup and either could delete or shadow the other's. That is latent while nothing calls the dead path, and stops being latent the moment anyone does. The table name moves to actornet with it, unexported, since actornet is now its only creator. The value is unchanged so an ateom rolling onto this code still recognises and clears the table its predecessor left behind. Two smaller leftovers of the same replacement: prepareOCIBundles no longer takes the ateom pod UID, because the namespace it writes into the bundle is keyed by actor now; and ateomnet's tests go with the code they covered, after porting the three that pin behaviour actornet still has -- repeatable setup, the fixed host-veth MAC, and the interior-link sweep. The last two are micro-VM requirements, so losing their coverage would have been a real gap rather than a bookkeeping one. NOTE: this collides with agent-substrate#1116, which moves the same table to the inet family, and with agent-substrate#1057 behind it. Both are dual-stack work on code this deletes. Whichever lands first, the other side is a delete-vs-modify conflict -- loud, and resolved by keeping the delete -- but the dual-stack change will need to be made in actornet instead. Worth settling before any of this becomes a real PR.
2 tasks
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
August 21, 2026 20:03
d7aab40 to
b33d33a
Compare
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
September 4, 2026 17:12
b33d33a to
90b0a69
Compare
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
2 times, most recently
from
September 4, 2026 23:03
4eda01f to
4026b86
Compare
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
September 4, 2026 23:19
4026b86 to
9da5460
Compare
Move the actor's NAT and filter rules from a table of family ip to one of family inet, so one table can hold both address families when the actor veth becomes dual-stack. Teardown sweeps tables of both ip and inet to handle the ip table an earlier ateom left behind. Tested: the kernel tests in net_linux_test.go, run as root on Linux, prove the kernel accepts the redirect in an inet nat chain, repeated setup/cleanup leaves no table behind, and teardown clears ip, inet, or both.
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
September 4, 2026 23:52
9da5460 to
0f965e1
Compare
Yuan Gao (ygao-g)
marked this pull request as ready for review
September 4, 2026 23:54
Yuan Gao (ygao-g)
requested review from
Lior Lieberman (LiorLieberman) and
Bowei Du (bowei)
September 4, 2026 23:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246.
The actor's NAT and filter rules live in an
iptable, which can only ever carry IPv4. This moves them to aninettable so one table can hold both address families once the actor veth is dual-stack. Every IPv4 match now opens with anNFPROTO_IPV4comparison, because a bare payload match in aninettable would read an IPv4 offset out of an IPv6 header. Teardown sweepsipas well asinet: a table name is unique per family, and the pod netns outlives an in-place container restart.IPv4 behaviour is unchanged, but this is not a no-op on a dual-stack pod.
inetnat chains register the nat hooks for both families, so IPv6 traffic in the worker pod netns is now conntracked — measured in a netns replica, where theiptable produced no IPv6 conntrack entries and theinettable does. The forward chain'sacceptnow covers IPv6 too; it is per-table, so it cannot override a drop from the CNI's own chains. NAT in theinetfamily needs Linux 5.2 or later, and the tests skip rather than fail below that.First of two: #1057 builds on this to give the actor an IPv6 address. This one has no dependency of its own.
Testing
TestActorNftablesRuleExprspins the rule expressions and needs no root, so it runs inmake test. Root-gated:TestSetupActorNetworkInstallsEgressRedirectchecks that aninetnat chain actually takes the redirect,TestRemoveActorNftablesRulesSweepsIPv4Familycovers theip→inetupgrade, andTestSetupActorNetworkIsRepeatableasserts the table is gone after each teardown.Three negative controls discriminate (Linux 6.17, under root): deleting the NFPROTO guard fails
TestActorNftablesRuleExprsandTestSetupActorNetworkInstallsEgressRedirectand nothing else, droppingipfrom the sweep fails onlyTestRemoveActorNftablesRulesSweepsIPv4Family, and skipping the redirect install fails onlyTestSetupActorNetworkInstallsEgressRedirect.🤖 This PR was developed with AI assistance. I have reviewed and tested all changes.